Forum Discussion

bortega_340015's avatar
bortega_340015
Icon for Nimbostratus rankNimbostratus
Apr 16, 2019

Send /var/log/ltm on syslog destination without AUDIT logs

Hello everyone,

I'm trying to filter just /var/log/ltm logs in F5 version 13.1.1.4, but with my configuration I can't filter the AUDIT logs, is still sending it to my syslog destination.

I configured this in syslog all-properties:

include " filter syslog_level { facility(local0) and level(debug..crit); };

filter no_audit {        not match ("AUDIT");    };

destination remote_server {
    udp(\"172.16.10.26\" port(4000));
};

log {
    source(local);
    filter(syslog_level);
    filter(no_audit);
    destination(remote_server);
};
"

But, when I tried to restart the service syslog-ng, shows the next message: WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please use a more specific filter like message() and/or program() instead.;

Any ideas how can I just receive /var/log/ltm on my syslog destination?

Thanks in advanced.

application delivery
LTM
TMSH
  • AMiles_377865's avatar
    AMiles_377865
    Apr 16, 2019

    Hello Berenice,

    You're on the right track; your syntax is just a little off. Match now requires the use of "value()"

    So I think something like 

    filter no_audit { not match ( value=("AUDIT") );    };

    Reference: Syslog Guide 3.0

    Best of luck,

    Austin

  • AMiles_377865's avatar
    AMiles_377865
    Icon for Cirrocumulus rankCirrocumulus
    Apr 16, 2019

    Hello Berenice,

    You're on the right track; your syntax is just a little off. Match now requires the use of "value()"

    So I think something like 

    filter no_audit { not match ( value=("AUDIT") );    };

    Reference: Syslog Guide 3.0

    Best of luck,

    Austin

    • bortega_340015's avatar
      bortega_340015
      Icon for Nimbostratus rankNimbostratus
      Apr 17, 2019

      Hello Austin,

       

      Thanks for your help. I modify the filter as you told me, but it shows a syntax error. However, your reference helps a lot. I find how to configure the filter like:

       

      filter no_audit { not match (AUDIT value(MESSAGE) ); };

       

      And it worked. Thanks.